获取系统进程快照 c语言实现

/************************************************************************/
/* 云守护
	email：542335496@qq.com                                                                     */
/************************************************************************/
#include <stdio.h>
#include <windows.h>
#include <TLHELP32.H>
#include <ntsecapi.h>
//需升级windows sdk,静态调用
#include	"psapi.h"
#pragma comment (lib,"psapi.lib")


//设置字体颜色
void SetColor(unsigned short ForeColor=4,unsigned short BackGroundColor=0)
{
	HANDLE hCon = GetStdHandle(STD_OUTPUT_HANDLE);//获得缓冲区句柄
	SetConsoleTextAttribute(hCon,ForeColor|BackGroundColor);//设置文本及背景颜色，可以使用color -?查看
};
//通过系统快照获取进程
BOOL GetProcessList(){

	HANDLE hProcessSnap;
	HANDLE hModuleSnap;
	BOOL bRet=FALSE;
	BOOL bModule=FALSE;
	PROCESSENTRY32 pe32={0};
	MODULEENTRY32 me32={0};
	pe32.dwSize=sizeof(PROCESSENTRY32);
	me32.dwSize=sizeof(MODULEENTRY32);
	hProcessSnap=CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0);
	bRet=Process32First(hProcessSnap,&pe32);
	while(bRet){
		
		SetColor(0,2);
		printf("进程：%s\n",pe32.szExeFile);
		SetColor(0,7);
		hModuleSnap=CreateToolhelp32Snapshot(TH32CS_SNAPMODULE,0);
		bModule=Module32First(hModuleSnap,&me32);
		while(bModule){
			printf("\t模块：%s\n",me32.szExePath);
			bModule=Module32Next(hModuleSnap,&me32);

		}
		bRet=Process32Next(hProcessSnap,&pe32);
	}
	CloseHandle(hProcessSnap);
	CloseHandle(hModuleSnap);

	return TRUE;
}
//第二种方法 PSAPI 静态调用
BOOL GetProcessListByPSAPi(){

	DWORD ProcessCount;
	DWORD cbNeeded;
	DWORD ProcessId[1024];
	
	EnumProcesses(ProcessId,sizeof(ProcessId),&cbNeeded);
	ProcessCount = cbNeeded/sizeof(DWORD);
	
	HMODULE hModule;
	char    szPath[MAX_PATH];
	
	for(DWORD i = 0; i < ProcessCount; i ++)
	{
		HANDLE hProcess = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ,FALSE,ProcessId[i]);
		if(hProcess)
		{
			EnumProcessModules(hProcess,&hModule,sizeof(hModule),&cbNeeded);
			GetModuleFileNameEx(hProcess,hModule,szPath,sizeof(szPath));
			SetColor(0,6);
			printf("PID:%d ",ProcessId[i]);
			SetColor(0,7);
			printf("\t%s\n",szPath);
		}
		else
			continue;
	}
	return TRUE;

}

//第三种方法 WTSAPI
typedef struct _WTS_PROCESS_INFO{
	DWORD SessionId;
	DWORD ProcessId;
	LPTSTR pProcessName;
	PSID pUserSid;
}WTS_PROCESS_INFO,*PWTS_PROCESS_INFO;

typedef HANDLE (WINAPI *WTSOPENSERVER)(LPTSTR pServerName);

typedef BOOL (WINAPI *WTSENUMRATEPROCESSES)(HANDLE hServer,DWORD Reserved,DWORD Version,PWTS_PROCESS_INFO* ppProcessInfo,DWORD *pCount);

//动态调用,合适用于windows NT/2000终端服务
BOOL GetProcessByWTSAPI(){

	HMODULE hWtsApi32 = LoadLibrary("wtsapi32.dll");
	if(hWtsApi32==NULL){
		printf("请升级sdk，没有找到wtsapi.dll");
		return FALSE;
	}
	WTSOPENSERVER pWtsOpenServer = (WTSOPENSERVER)GetProcAddress(hWtsApi32,"WTSOpenSeverA");
	WTSENUMRATEPROCESSES pWtsEnumrateProcesses = (WTSENUMRATEPROCESSES)GetProcAddress(hWtsApi32,"WTSEnumrateProcessesA");
	//终端服务名字,可以使用nbtstat -an 命令查看
	char *szServerName = " 1FB978629C104D4";
	HANDLE hWtsServer = pWtsOpenServer(szServerName);
	
	PWTS_PROCESS_INFO pWtsapi;
	DWORD dwCount;
	
	if(!pWtsEnumrateProcesses(hWtsServer,0,1,&pWtsapi,&dwCount))
		return FALSE;
	
	for(DWORD i = 0; i < dwCount; i ++)
	{
		printf("ProcessID: %d (%s)\n",pWtsapi[i].ProcessId,pWtsapi[i].pProcessName);
	}

	return TRUE;
}
//第四种方法
#define SystemProcessesAndThreadsInformation	5
// 动态调用
typedef DWORD (WINAPI *ZWQUERYSYSTEMINFORMATION) (DWORD,
												  PVOID,
												  DWORD,
												  PDWORD);
// 结构定义
typedef struct _SYSTEM_PROCESS_INFORMATION{
	DWORD		NextEntryDelta;
	DWORD		ThreadCount;
	DWORD		Reserved1[6];
	FILETIME	ftCreateTime;
	FILETIME	ftUserTime;
	FILETIME	ftKernelTime;
	UNICODE_STRING ProcessName;
	DWORD		BasePriority;
	DWORD		ProcessId;
	DWORD		InheritedFromProcessId;
	DWORD		HandleCount;
	DWORD		Reserved2[2];
	DWORD		VmCounters;
	DWORD		dCommitCharge;
	PVOID		ThreadInfos[1];
}SYSTEM_PROCESS_INFORMATION, *PSYSTEM_PROCESS_INFORMATION;


BOOL GetProcessListByNTDLL(){

	// 导出函数
	HMODULE hNtDll = GetModuleHandle("ntdll.dll");
	ZWQUERYSYSTEMINFORMATION ZwQuerySystemInformation = (ZWQUERYSYSTEMINFORMATION)GetProcAddress(hNtDll,"ZwQuerySystemInformation");
	
	ULONG  cbBuffer = 0x10000;
	LPVOID pBuffer  = NULL;
	
	pBuffer = malloc(cbBuffer);
	if(pBuffer == NULL)
		return -1;	
	// 获取进程信息
	ZwQuerySystemInformation(SystemProcessesAndThreadsInformation,pBuffer,cbBuffer,NULL);
	// 指针指向链表头部
	PSYSTEM_PROCESS_INFORMATION pInfo = (PSYSTEM_PROCESS_INFORMATION)pBuffer;	
	// 输出结果
	for(;;)
	{
		SetColor(0,13);
		printf("PID:%d  ",pInfo->ProcessId);
		SetColor(0,7);
		printf("\t%ls\n",pInfo->ProcessName.Buffer);
		if(pInfo->NextEntryDelta == 0)
			break;		
		// 读取下一个节点
		pInfo = (PSYSTEM_PROCESS_INFORMATION)(((PUCHAR)pInfo)+pInfo->NextEntryDelta);
	}
	// 释放缓冲区
	free(pBuffer);

	return TRUE;
}
void main(){

	//GetProcessList();
	//GetProcessListByPSAPi();
	//GetProcessByWTSAPI();
	GetProcessListByNTDLL();
}